A large company tracking information on its network systems, users, etc., can create large volumes of data very rapidly, e.g., upwards of 1 TB/day. The data is only useful to the company if it can be analyzed. Some desired data analysis steps can be precomputed and do not need to be performed in real time (e.g., in response to a user request, while the user is waiting for the response), however for some this is not possible. Data analysis may be desired on different subsets of data in order to get a better picture, e.g., data taken on certain days, at certain times, for certain users, etc. Too many different possible subsets exist to precompute data analysis for all of them, creating a problem where data analysis steps must be efficient enough to execute in real time on very large data sets. In addition, in some cases real-time analysis is critical as corrective action(s) cannot be taken without real-time information.